UNITED STATES OF AMERICA 



) 
) 
) 
) 
) 
) 
) 
) 
) 



v. 



Prosecution Disclosure 
to the Defense 




26 October 2012 



On 26 October 201 2, the United States filed an in camera motion requesting the Court 
consider a motion in camera and ex parte under MRE 505(g)(2) and for an additional protective 
order for classified information under MRE 505(g)(1). See Enclosure. The United States seeks 
to protect information relating to intelligence activities, intelligence sources or methods, and 
foreign relations or foreign activities of the United States, all within the national security 
interests of the United States. 



I certify that I served or caused to be served a true copy of the above on Mr. David Coombs, 
Civilian Defense Counsel via electronic mail, on 26 October 2012. 




ASHDbN FEIN 

MAJ, JA 
Trial Counsel 



ASHDEN FEIN 
MAJ, JA 

Trial Counsel 
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AMERICA 



v. 



Manning, Bradley K. 

PFC, U.S. Army. 

HHC, U.S. Army Garrison, 

.Joint Base Myer-Henderson Hall 

Fort Myer, Virginia 22211 



) 
) 
) 

) 

) 

) 

) 



Government in camera Motion to 
Redact or Delete Classified Information 
from Evidence Made Available 
to the Accused under MRE 505(u)<2) 
and for an Additional Protective Order 



for Classified Information 
under MRE 505(g)(1) 



26 October 2012 



RELIEF SOUGHT 



(U) COMES NOW the United States of America, by and through undersigned counsel, 
and respectfully requests this Court: (1) consider this motion and the enclosures in camera and 
ex pane under Military Rule of Evidence (MRE) 505(g)(2): (2) affirmatively authorize 
redactions and "deletions" of classified information from evidence made available to the defence: 
and (3) issue an additional protective order, under MRE 505(g)(1), precluding the defense and 
their forensic expert from accessing irrelevant ''deleted" classified information on the digital 
media made available to the defense for examination/ The information sought to be redacted or 
deleted from discovery will not be used by the prosecution, is not relevant to this court-martial, is 
not favorable to the accused and material to guilt or punishment, or relevant and necessary for 
production under Rule for Courts-Martial (RCM) 703(0- The information is also not "necessary 
to enable the accused to prepare for trial." MRE 505(g)(2). 

BURDEN OF PERSUASION AND BURDEN OF PROOF 

(U) As the moving party, the United States has the burden of persuasion on any factual 
issue the resolution of which is necessary to decide the motion. RCM 905(c)(2). The burden ol 
proof is by a preponderance of the evidence. RCM 905(c)( 1 ). 

FACTS 2 




■ 




! (U) For the purposes ol this motion, the United Slates does not intend lo actually "delete" any digital information, 
but impose digital restrictions, coupled with a Court order, which would prevent the defense and their computer 
forensic experts from accessing or viewing the "deleted'* digital files. This process is described below. Se.£ uiJxa. 

(U) I or the purposes of this motion, the United Slates added footnotes, with appropriate Bates numbers, to any 
portion of the facts that reference classified materia) thai has been provided to the defense in classified discovery. 
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(U) This enclosure is Bates #; (K)5()525() 00505252 
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(U) A "7-zip" file is a file archive with a high compression ratio, similar to a "zip" file. See http://wvvw.7-zip.org, 
(last accessed 27 September 2(1 12). 
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,: (U) On 3 August 2012, the United States sent Enclosure 9 (discovery letter) to the defense through their security 
experts via SfFRNET. 

7 (U)These enclosures are Bates #: 00505234-00505249, 005052 18-00505227, 00505228-00505233, and 
00505208-00505217. 

(U) These enclosures were originally produced in their original form on a compact disc withoul Bates numbers 
because they were digital files with unique Hash values. The defense received copies of the compact disc on 7 
August 2012 at the Naval War College via FEDEX and 10 August 2012 via hand delivery to MAJ Hut ley. 
Enclosure 14 (email to defense, dated 6 August 2012 with FEDEX delivery confirmation and Department of ihe 
Army Form 200), 

* 4 

l} (U) A thumb drive or Secure Digital (SD) card is a memory card developed for use in portable devices. Si^ 
http://www.sdcard.org/consumers (last accessed 27 September 2012). They have become a widespread means of 
storing gigabytes of data in a small device, lit 

Classified by: Ashden Fein 
Derived from: Multiple Sources 
Declassify on: 25X1 
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(U) There is no evidence that the accused communicated directly with any terrorist or 
terrorist organization or that any terrorist or terrorist organization communicated directly with 

the accused. 

WITNESSES/EVIDENCE 

(U) The United States does not request any witnesses be produced for this motion. The 
prosecution requests that the Court consider the enclosures listed at the end of this motion. 

LEGAL AUTHORITY AND ARGUMENT 
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(U) This moion is submitted affirmatively by the United States and riot in response to a 
discovery request or motion to compel discovery. The defense has been aware of the general 
nature of this evidence since 8 November 201 1, as this evidence was briefed to the defense 
during a presentation of the government's case prior to the Article 32 investigation. By 
affirmatively approaching the Court under MRE 505(g)(2), rather than wait for any potential 
defense discovery request or motion, the United States is seeking to prevent delay in an effort to 
move the case forward in accordance with the current calendar. 

(U) If classified information is at issue in a court-martial, the United States may agree to 
disclose the classified information to the defense under a protective order. See MRE 5()5(g)( 1 ). 
Additionally, the United States may motion the Court to "authorize (A) the deletion of specific 
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items of classified information from documents to be made available to the [accused], (B) the 
substitution of a portion or summary of the information for classified documents, or (C) the 
substitution of a statement admitting relevant facts that the classified information would tend to 
prove." MRE 505(g)(2). The military judge "shall authorize" these alternative forms, unless she 
determines "the disclosure of the classified information itself is necessary to enable the accused 
to prepare for trial." jdL If a motion is filed under MRE 505(g)(2), then upon request of the 
United Slates, the motion "shall" be considered by the military judge in camera and "shall not be 
disclosed to the accused." Id. 



(U) The procedures outlined in MRE 5()5(g)(l ) and (2) apply when the United States 
voluntarily discloses information and does not withhold classified information under MRE 
505(c). If the United States intends to withhold information under MRE 505(c), then the United 
States must move for an in camera proceeding under MRE 505(i)(2), obtain an affidavit 
demonstrating that disclosure of the information reasonably could be expected to cause damage 
to the national security under MRE 505(i)(.T) ? and follow the notice procedures outlined under 
MRE 505(i)(4). See MRE 505(i). For the purposes of this filing, the equity holder, through the 
prosecution, is voluntarily disclosing redacted documents and files, authorizing limited access to 
the digital media, and is not withholdingany classified information under MRE 505(c) and MRE 
505(i)7 



(U) The United S tates r equests this Court authorize the redaction of classified 
information from documents previously pr ov ided to the d efense in discovery by defimnining that 
the redacted information is not discoverable under any releva nt standard . 
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(U) Should the Court find the redacted information is discoverable under RCM 
701(a)(6) or Bradv/ Gigllo . subject to production under RCM 703(f), or "necessary to enable the 
accused to prepare for trial" under MRE 505(g)(2), then the United States requests the 
opportunity to either (1) address the Court's findings with the relevant government agency io 
determine whether a different alternative under MRE 505(g)(2) is appropriate and file that 
alternative with the Court, or (2) allow for the relevant government agency to claim a privilege 
under MRE 505(c) and the United States to move for an in camera proceeding under MRE 
505(i). 



(U) As stated above, the United States will not use any portion of these 
documents not disclosed to the defense during any portion of the trial. This includes rebuttal and 
rule of completeness if the defense introduces or references anything in the un-redacted portions. 



(U) The United States re quests this Court authorize the "deletion*' of classified 
information from certain d igital, me dia that is not disco ve rable unde r a ny relev ant standard 
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(U) "Slack space ? * is defined as the "space between the end of a file and the end oi the disk cluster it is siored in" 
See hUp://\v\vvv.peniag.conVency^^ (last aceessed i October 

2012). 
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(U) Should the Court find the deleted information is discoverable under RCM 
701(a)(6) or Brady/Gigiio, subject to production under RCM 703(f), or "necessary to enable the 
accused to prepare for trial" under M RE 505(g)(2). then the United States requests the 
opportunity to either (1) address the Court's findings with the relevant government agency to 
determine whether a different alternative under MRE 505(g)(2) is appropriate and file thai 
alternative with the Court, or (2) allow for the relevant government agency to claim a privilege 
under MRE 505(c) and the United Stales to move for an in camera proceeding under MRE 
505(i). 5: 



(U) As stated earlier, the United States will not use any portion of the remaining 
digital files not disclosed to the defense during any portion of the trial. 

(U) If the Court determines that remaining digital files are not discoverabl e under anv 



relevant standard, and authorizes the "deletion 



media ahejitjbeJLMted $tat^ requests this C 



from examining 
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examination, if anv. 



(U) On 3 August 2012, the United States made forensic images of the digital 
media available to the defense and their security experts for forensic inspection, in order to 
ensure the defense has the ability to adequately examine the digital files that the United Stales 
intends to use as evidence. S££ Enclosure 9. To assist the defense and ensure proper 
accountability of the digital media, the United States acquired a classified forensic computer, 
with AccessData Lab 3.x installed as industry standard forensic analysis software. Using the 
AccessData Lab 3.x software, the United States can restrict access to certain documents and 
authorize access to other documents for anyone who uses the computer. Within the program, the 
process of restricting access is called "privileging." If the Court authorizes the deletion of the 
above information, then all remaining digital files, except the digital files the United States 
intends to use during trial, will not be accessible to the defense or their computer forensic 
examiner. This program and process will allow the defense and their computer forensic 
examiner to examine the metadata associated with the four relevant files which will be used by 
the United States, so the defense may validate the forensic process of pulling the files from the 
media and cross-examine the FBI forensic examiner, if they choose. The "privileging" has 
already occurred on the classified forensic computer. As such, the process will not take any 
additional time to complete if the Court authorizes this deletion. 



(U) As a forensic examiner conducts analysis, he or she has access to the 
following information, along with being able to view the content, for the "unprivileged" digital 
files: file name; item number: acquisition MD5 and SHA1 hashes; the created dale and time: 



(U) The United Stales seeks to protect information relating to intelligence activities, intelligence sources or 
methods, and foreign relations or foreign activities of the United States, all within the national security interests ot 
the United Slates. 
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accessed date and time; modified date and time; "P~Size M for physical size: "L-Size" for logical 
size; file type, and the entire native file path. 13 When a forensic examiner "'clicks" on an 
'unprivileged" file to view the forensic metadata, the program allows the examiner to view the 
contents of the file without limitation. If the Court authorizes the redactions of the files 
referenced above, the forensic examiners would be able to scroll through the original documents 
on the digital media and view the redacted original content, essentially eliminating the purpose 
of the redactions. Therefore, the United States requests the Court issue the enclosed srotective 
order, under MRh 505(g)(1), precluding the defense, including their forensic examiners, from 
examining the contents of the two above-mentioned files on the digital media. Specifically, the 
defense, including their forensic examiners should be precluded from viewing the contents of the 
redacted documents during a forensic examination, if any. See Enclosure 16. Additionally, the 
United States requests the Court order any defense forensic examination be conducted under the 
supervision of the Court Security Officer to ensure proper enforcement of the order. 
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(U) The following definitions arc derived from Enclosure 13. which is a glossary of terms found in EnCase 
Forensic Software, which uses industry standard terms also found in AecessDala 3.x: ( I ) file name: "is the name 
Windows gives the entry using the DOS 8.3 naming convention;" (2) item number; which is produced by AI)l ah 
and referenced in the forensic report; (3) acquisition MD5 and SI i A 1 hashes: "is a 128-bit value for a file entry 
generated by a hash analysis process" using either the "MD5 :! or "SHAT algorithm: (4) the created date and time: 
"typically reflects the date/time the file/folder was created at that location. . . [a] notable exception to this is the 
extraction of files/folders from a ZIP archive... [tjhose ob jects will carry the created date/time as they existed when 
the objects were placed in the archive!:}" (5) accessed date and time: "displays the last accessed dale- time - thi> 
typically reflects the last time the operating system or any compliant application touched the file (such as viewing, 
dragging, or right-clicking)): |" (6) modified date and time: this ty pically reflects the last time the operating system 
or any compliant application altered the file: (7) "P-Size" for physical size: 'specifies the size of the storage areas 
allocated to the filej:)" (8) "L-Size ir for logical size: "specifies the file size as the operating system addresses the 
file[;| ' (9) file type: 'identifies the type of file: after a Signature Analysis is run, this data is generated from the 
results] :|" and (10) the entire native file path: 'identifies the location the file is located within the evidence file, 
including the evidence file name and a volume identifier).)''' 
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CONCLUSION 



(U) The United States respectfully requests this Court: (1) consider this motion and the 
enclosures in camera and ex parte under Military Rule of Evidence (MRE) 505(g)(2); (2 ) 
affirmatively authorize redactions and deletions of classified information from evidence made 
available to the defense: and (3) issue an additional protective order, under MRE 505(g)(1), 
precluding the defense and their forensic expert from accessing irrelevant ' deleted" classified 
information on the digital media made available to the defense. 



ASHDEN FEIN 

MAJ, J A 
Trial Counsel 



6 Enclosures 





(b)(1)(B) 






9. (V) Discovery Letter. 3 August 2012 
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13. (U) Excerpt from EnCase User Manual 

14. (U) Email to Defense, dated 6 August 2012 with FEDEX delivery confirmation and 
Department of the Army Form 200 
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16. (U) Proposed Protective Order [classified 11 
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